Hi Maria There has been quite a discussion in the last 24 hours from various angles about interpretation of terminology and purposes and context. Perhaps this is a good moment to pause and allow the legal team to review the discussion and see if anything that has been said affects your analysis.
Cheers denis Co-chair DB-WG On Thu, 28 Jul 2022, 13:33 Maria Stafyla via db-wg, <db-wg@ripe.net> wrote: > Dear colleagues, > > Following the legal update we provided on NWI-13: Geofeed at the DB WG > session at RIPE 84, here is our analysis in case further discussion on this > topic is needed. > > Executive Summary: > > - The RIPE Database is meant to contain specific information for > its documented purposes. > > - Information inserted in the geofeed attribute could in some cases > qualify as personal data. > > - The current purposes could explain geolocation information to be > inserted only for ‘scientific research into network operations and > topology’. > > - This purpose does not justify the processing of personal data; > therefore restrictions had to be put in place to avoid the processing of > unnecessary personal data. > > - The restrictions are now implemented based on the status of the > registration. > > - If the purposes of the RIPE Database have changed in the > meantime, this should be established via the community processes and > documented. In that case we will re-evaluate the situation and the need for > restrictions. Until then, the restrictions remain necessary. > > > Legal Analysis: > > The RIPE Database is meant to contain specific information for the > purposes that are defined in the RIPE Database Terms and Conditions. > > In terms of the _personal data_ inserted in there, the purpose that > justifies its publication is to facilitate the coordination of network > operations for the smooth and uninterrupted operation of Internet; this > purpose explains why contact details of resource holders or their appointed > contact persons are required. > > Before any new type of personal data is permitted to be inserted in the > RIPE Database, we must evaluate if their processing is required for the > purposes already defined and their processing can be considered in line > with the basic personal data processing principles. > > Although it is the responsibility of the party inserting personal data to > ensure that they have the appropriate legal grounds before doing so, the > RIPE NCC has also shared responsibilities with regards to the personal data > in the RIPE Database. This is because the RIPE NCC is the party that is > making the RIPE Database available and implements the instructions given by > the RIPE community. > > As mentioned in the Legal Review Impact Analysis, if the geofeed attribute > is inserted for registrations of assignments that are reasonably assumed to > be related to one individual user, then the attribute will be considered as > containing personal data and GDPR will apply. This is why we have proposed > to implement restrictions. > > These restrictions are essential to avoid any processing of personal data > that is not required or necessary for the *currently defined* purposes of > the RIPE Database and to limit the RIPE NCC's liability as a party with > shared responsibilities in relation to the personal data inserted in the > RIPE Database. > > Regarding the _(non-personal) data _inserted in the RIPE Database, it is > also paramount that only data that is needed for the defined purposes of > the RIPE Database is inserted. > > According to the RIPE Database Terms and Conditions, introducing the > geofeed attribute (with restrictions) would be considered in line and > acceptable to be used only for scientific research into network operations > and topology (see Art. 3). > > We also understand that the purposes the RIPE Database must fulfil are not > static but evolve over time. > > The RIPE Database Requirements Task Force has recently concluded its work > and, with regard to geolocation, it has established that, although there is > an active user group for geolocation data, geolocation itself is not an > objective that the RIPE Database should fulfil. > > If the community's interests have changed since then and it is now agreed > that geolocation is one of the purposes the RIPE Database must fulfil, this > should be decided via the community's processes and reflected in the RIPE > Database Terms and Conditions. > > In line with the data management principles proposed by the RIPE Database > Requirements Task Force, it would be prudent to approach this issue > holistically, taking into account that other geolocation information is > already provided in the RIPE Database (i.e. geoloc, country code attributes > in ORG and resource objects). > > On the basis of a new purpose for the geolocation information, we could > then reassess the situation to understand whether the restrictions on the > geofeed attribute are still necessary or whether it is justified to process > personal data for this purpose. > > Kind regards, > > Maria Stafyla > Senior Legal Counsel > RIPE NCC > > -- > > To unsubscribe from this mailing list, get a password reminder, or change > your subscription options, please visit: > https://lists.ripe.net/mailman/listinfo/db-wg >
-- To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/db-wg
